CVE-2021-34646

CVE-2021-34646 PoC this vulnerability detail by NVD Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the processemailverification function due to a random token generation weakness in the resetandmailactivationlink...

CVE-2023-3460

CVE-2023-3460 Exploit for CVE-2023-3460 - Unauthorized admin access for Ultimate Member plugin. PoC is now published. It was created for educational/research purposes only! Use it at your own risk!...

CVE-2021-24891-Simulation

A hands-on, containerized lab environment to simulate and exploit a DOM-based Cross-Site Scripting XSS vulnerability in the Elementor Website Builder WordPress plugin, identified as CVE-2021-24891. 📖 About The Vulnerability This lab demonstrates a DOM-based Cross-Site Scripting XSS vulnerability ...

CVE-2025-2294

CVE-2025-2294 - WordPress Kubio AI Page Builder = 2.5.1 - Local File Inclusion LFI Exploit Overview CVE-2025-2294 affects the Kubio AI Page Builder plugin for WordPress versions up to and including 2.5.1. It suffers from an unauthenticated Local File Inclusion LFI vulnerability via the...

CVE-2024-12025

CVE-2024-12025 Collapsing Categories = 3.0.8 - Unauthenticated SQL Injection Description The Collapsing Categories plugin for WordPress is vulnerable to SQL Injection via the 'taxonomy' parameter of the /wp-json/collapsing-categories/v1/get REST API in all versions up to, and including, 3.0.8 due...

wordpress-really-simple-security-authn-bypass-exploit

wordpress-really-simple-security-authn-bypass-exploit This is a Python3 program that exploits Really Simple Security 9.1.2 authentication bypass vulnerability CVE-2024-10924. DISCLAIMER This tool is intended for security engineers and appsec people for security assessments. Please use this tool...

CVE-2025-2294

CVE-2025-2294 🚨 CVE-2025-2294 - Local File Inclusion LFI Vulnerability in Kubio AI Page Builder for WordPress 🧱 🔍 Overview CVE-2025-2294 is a critical 🔥 Local File Inclusion LFI vulnerability affecting the Kubio AI Page Builder plugin for WordPress versions up to and including 2.5.1. This flaw...

CVE-2024-54363-Exploit

CVE-2024-54363-Exploit Incorrect Privilege Assignment vulnerability in nssTheme Wp NssUser Register allows Privilege Escalation.This issue affects Wp NssUser Register: from n/a through 1.0.0. Description The nssTheme Wp NssUser Register plugin for WordPress is vulnerable to an Incorrect Privilege...

CVE-2024-27956-RCE

CVE-2024-27956-RCE A PoC for CVE-2024-27956, a SQL Injection in ValvePress Automatic plugin. This PoC exploit the vulnerability creating a user in the target and giving Administrator rights. Being an administrator in wordpress can lead to Remote Code Execution. Usage git clone...

Wp2shell-ioc-scanner

wp2shell IOC Scanner Version 1.4.0 · GPL-2.0-or-later · WordPress 6.0+ · PHP 7.4+ A read-only-by-default triage tool for the WordPress core vulnerabilities CVE-2026-60137 and CVE-2026-63030 “wp2shell”. It checks patch state, accounts, durable database artifacts and file integrity, separates...

Job-Manager-Disclosure

CV Filename Disclosure Scanner – CVE-2015-6668 This script automates the search for CV files such as .jpg, .png, .jpeg publicly exposed via the vulnerability CVE-2015-6668, related to the WP Job Manager plugin for WordPress versions ≤ 0.7.25. 🧠 Description The vulnerability allows knowing the exa...

CVE-2024-8743-PoC

CVE-2024-8743 PoC Background Proof-of-Concept script for WordPress plugin Bit File Manager version = 6.5.7 Authenticated Subscriber+ Limited JavaScript File Upload CVE-2024-8743 vulnerability Information Description: The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for...

CVE-2025-47577

CVE-2025-47577 A proof of concept developed to exploit CVE-2025-47577. Based on PatchStack's article. Usage usage: python CVE-2025-47577.py --help TI WooCommerce Wishlist WordPress plugin = 2.9.2 CVE-2025-47577 PoC positional arguments: FILE local file to upload URLPATH base path of the wish list...

CVE-2025-5815-Nuclei-Template

📄 Nuclei Template for CVE-2025-5815 🚀 Overview This repository features a Nuclei template specifically designed to detect an Unauthenticated Bot Logging Disable Vulnerability CVE-2025-5815 in the Traffic Monitor WordPress plugin. This issue allows unauthenticated attackers to remotely disable bot...

CVE-2024-2879

CVE-2024-2879 Description LayerSlider 7.9.11 - 7.10.0 - Unauthenticated SQL Injection The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the lsgetpopupmarkup action in versions 7.9.11 and 7.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficien...

CVE-2024-45590-PoC

CVE-2024-45590 - WordPress Plugin RCE PoC Vulnerability Details - CVE: CVE-2024-45590 - CVSS: 9.8 Critical - Type: Unauthenticated RCE via Arbitrary File Upload - Affected: WordPress Plugin Proof of Concept Demonstrates safe RCE exploitation with two commands: 1. id - Command execution proof 2...

CVE-2018-7422

CVE-2018-12613 Local file inclusion bug due to no sanitization of user input. Software Affected 1. Wordpress Plugin: Site-Editor v.1.1.1; How to use This PowerShell scripts need two parameters to craft a exploit HTTP request: 1. Wordpress URL endpoint 2. A full path file to be retrieved in remote...

CVE-2024-2667

InstaWP Connect – 1-click WP Staging & Migration You can use any valid or invalid API Key. overridepluginzip - Path to the zip file which contains malicious WordPress Plugin with a backdoor. Once imported you can access the backdoor via...

wp-file-manager-CVE-2020-25213

WP-file-manager expoit CVE-2020-25213 WP-file-manager wordpress plugin 6.9 vulnerable to unauthenticated arbitary file upload resulting in full compromise of the system. For More more details refer to my writeup published here Disclaimer I haven't discovered this vulnerability & neither taking an...

CVE-2025-8889

Exploit Title: WordPress Compress Then Upload Plugin 1.0.3 Arbitrary File Upload to RCE Date: 2025-07-23 Exploit Author: Muhammed Çelik Vendor Homepage: https://wordpress.com/plugins/compress-then-upload Software Link: https://downloads.wordpress.org/plugin/compress-then-upload.latest-stable.zip...